A security issue,
CVE-2025-59378, has
been identified in
guix-daemon,
which allows for a local user to gain the privileges of any of the
build users and subsequently use this to manipulate the output of any
build. In the case of the rootless daemon, this also means gaining the
privileges of guix-daemon. All systems are affected, whether or not
guix-daemon is running with root privileges. You are strongly
advised to upgrade your daemon now (see instructions below).
The only requirements to exploit this are the ability to create and build an
arbitrary derivation that has builtin:download as its builder, and to execute
a setuid program on the system in question. As such, this represents an
increased risk primarily to multi-user systems, but also more generally to any
system in which untrusted code may be able to access guix-daemon's socket, which
is usually located at /var/guix/daemon-socket/socket.
Vulnerability
guix-daemon currently supports two so-called built-in builders for
derivations:
builtin:download and builtin:git-download. Their primary utility is
currently to circumvent bootstrapping challenges in code-downloading derivations
(that is, "how does one get the programs that are used to download programs?")
by using "host-side" programs for this purpose.
In particular, download and git-download are currently implemented in the
(guix scripts perform-download) module, which can be run as a standalone
program using guix perform-download. At the time that perform-download was
written, it was believed to be sufficient for security purposes to ensure that
it was run by a build user, and so one of the user-supplied values (the file
named by the derivation's content-addressed-mirrors environment variable) was
read and evaluated as arbitrary Guile code.
This suffices to protect a regular user from an untrusted derivation they may be
building, since all processes owned by the build user will be killed at the end
of the build, before any other build can be run that uses the same build
user. It does not suffice, however, to protect the daemon's build users – and by
extension the integrity of the daemon's builds – from a regular user. In
particular, a content-addressed-mirrors file can be written to create a setuid
program that allows a regular user to gain the privileges of the build user that
runs it even after the build has ended. This is similar in impact to
CVE-2025-46416,
though using a somewhat different mechanism.
Mitigation
This security issue has been fixed by 3 commits
(2a33354,
f607aaa,
and
9202921)
as part of
pull request #2419. Users should
make sure they have upgraded to commit
1618ca7
or any later commit to be protected
from this vulnerability. Upgrade instructions are in the following section.
The fix was accomplished by changing (guix scripts perform-download) to
evaluate the content-addressed-mirrors file in a Guile isolated
environment,
as well as verifying that this file and the others that perform-download reads
is neither outside of the store nor a symbolic link to a file outside of the
store, so that this cannot be used to cause arbitrary files (such as
/proc/PID/fd/N) to be read. Measures were also taken to ensure that calls to
read never cause code to be evaluated.
A test for the presence of this vulnerability is available at the end of this
post. One can run this code with:
guix repl -- content-addressed-mirrors-vuln-check.scm
This will output whether the current guix-daemon being used is vulnerable or
not. If it is not vulnerable, the last line will contain guix-daemon is not vulnerable and guix repl will exit with status code 0, otherwise the last
line will contain guix-daemon is VULNERABLE and guix repl will exit with
status code 1.
Upgrading
Due to the severity of this security advisory, we strongly recommend
all users to upgrade guix-daemon immediately.
For Guix System, the
procedure
is to reconfigure the system after a guix pull, either restarting
guix-daemon or rebooting. For example:
guix pull
sudo guix system reconfigure /run/current-system/configuration.scm
sudo herd restart guix-daemon
where /run/current-system/configuration.scm is the current system
configuration but could, of course, be replaced by a system
configuration file of a user's choice.
For Guix on another distribution, one
needs to guix pull with sudo, as the guix-daemon runs as root,
and restart the guix-daemon service, as
documented.
For example, on a system using systemd to manage services, run:
sudo --login guix pull
sudo systemctl restart guix-daemon.service
Note that for users with their distro's package of Guix (as opposed to
having used the install
script)
you may need to take other steps or upgrade the Guix package as per
other packages on your distro. Please consult the relevant
documentation from your distro or contact the package maintainer for
additional information or questions.
Conclusion
Test for presence of vulnerability
Below is code to check if your guix-daemon is vulnerable to this exploit. Save
this file as content-addressed-mirrors-vuln-check.scm and run following the
instructions above, in "Mitigation."
(use-modules (guix monads)
(guix derivations)
(guix gexp)
(guix store)
(guix utils)
(guix packages)
(srfi srfi-34))
(define %test-filename
"/tmp/content-addressed-mirrors-vulnerable")
(define %test-content-addressed-mirrors
`(begin
(mkdir ,%test-filename)
(exit 33)))
(define %test-content-addressed-mirrors-file
(plain-file "content-addressed-mirrors"
(object->string %test-content-addressed-mirrors)))
(define (test-content-addressed-mirrors content-addressed-mirrors)
(mlet %store-monad ((content-addressed-mirrors
(lower-object content-addressed-mirrors)))
(raw-derivation "content-addressed-mirrors-vuln-check"
"builtin:download"
'()
#:hash
(base32
"dddddddddddddddddddddddddddddddddddddddddddddddddddd")
#:hash-algo 'sha256
#:sources (list content-addressed-mirrors)
#:env-vars `(("url" . "/doesnotexist")
("content-addressed-mirrors"
. ,content-addressed-mirrors))
#:local-build? #t)))
(with-store store
(let ((drv (run-with-store store (test-content-addressed-mirrors
%test-content-addressed-mirrors-file))))
(guard (c ((and (store-protocol-error? c)
(string-contains (store-protocol-error-message c) "failed"))
(cond
((file-exists? %test-filename)
(format #t "content-addressed-mirrors can evaluate arbitrary code, guix-daemon is VULNERABLE~%")
(exit 1))
(else
(format #t "content-addressed-mirrors can't create files, guix-daemon is not vulnerable~%")
(exit 0)))))
(build-derivations store (list drv)))))
